# Contract: KernelSU hide / umount surface

**Feature**: `007-kernelsu-sunfish`  
**Consumers**: LAB validation (`quickstart.md`), future `011` signed builds

## Root grant

| Rule | Requirement |
|------|-------------|
| Default | No app has root until explicitly allowed |
| Banking | `com.yuh`, `com.swissquote.android` → **deny** on all tested `userId`s |
| Proof | Manager UI alone insufficient; show failed `su`/root API from those UIDs |

## Mount hide

| Rule | Requirement |
|------|-------------|
| Mechanism | KernelSU umount / profile hide (and SusFS when enabled) |
| Proof | From banking (or probe) UID, sensitive module/overlay paths that appear
  to a normal rooted UID are **absent** or inaccessible |
| `path_umount` | Must work on this 4.14 integration or be explicitly filed as blocker |

## Non-goals

- Magisk DenyList semantics as the production contract
- LSPosed/Zygisk hide
- Claiming “legitimate system” without Yuh PASS (see `banking-yuh-gate.md`)

## Mandatory evidence checklist

For each banking package × tested user ID, record PASS/FAIL, method and artifact:
- root grant denied;
- denied root access demonstrated;
- module mount visibility before/after recorded;
- configured unmount mechanism actually removes the test mount.

All rows must PASS. A probe must reproduce the target policy and namespace;
a different UID with unrelated settings is not evidence for the banking UID.
Unavailable evidence is unverified, not PASS. Optional SUSFS checks apply only
when enabled and must identify their tested paths.